Novaris Privacy Notice
Last updated: October 26, 2026
1. Who this notice is for
This notice covers three groups of people:
- Visitors to www.novariscall.com and app.novariscall.com, including anyone who tries the demo.
- Resellers, and people who start a reseller sign-up, whether or not they finish it.
- People who contact us, by email or through the support function in a reseller account.
It does not cover the clients of a reseller, or the people who call them. A reseller provides the service to its clients under its own brand and its own privacy notice. Our role in relation to the data of a reseller's clients and their callers is set out in the data processing agreement in the Reseller Agreement. If you are a client of a reseller, or you have called one, their privacy notice applies and your request should go to them.
2. Who we are
Northbound Tech Ltd is the controller of the personal data described in this notice. It is a company registered in England and Wales with company number 17432444, registered office 71-75 Shelton Street, London WC2H 9JQ. Novaris is a product of Northbound Tech Ltd.
Privacy contact: privacy@novariscall.com. For anything that is not a privacy request, such as billing or a login that will not work, write to support@novariscall.com.
Northbound Tech Ltd has not appointed a data protection officer; it is not required to, given its size and the nature of its processing. It has no representative in the European Union: the platform launches for United States resellers only, with billing in US dollars. This does not restrict who can visit our websites; this notice also covers visitors in the United Kingdom and European Union.
3. What we collect
From a visitor
- Information your browser sends when you visit, such as your IP address, browser type and the pages you view.
- Page views, clicks, masked session replay on permitted public pages, and measurement of which steps of sign-up are reached in the app, subject to the choices in section 7. Advertising measurement runs on the marketing site and in the app's demo, sign-up and payment steps. No analytics run on a reseller's own application address.
From the demo
- What you say to the demo agent, as a written transcript, and what the agent says.
- When and for how long you used it, and a limit counter per visitor so the demo can enforce its daily cap.
The demo tells you the call is recorded. Do not give it information about other people or payment card details.
From a reseller, at sign-up and afterwards
- Your email address and password.
- Your business name, and a mobile number for text messages about your account.
- Whether you sign up as a company or an individual, your legal name, your company number if you are a company, your business address, and for a company the name of a contact person.
- The tier you choose.
- Your country, and your VAT number if you have one.
- Payment card details, which you enter directly with our payment provider. We receive a token and the last four digits; we do not store the full card number.
- Your acceptance of the Reseller Agreement, with the date and time.
- After sign-up: your brand (name, logo and colors), your web address, your support contact for your clients, optional business details used to register a text sender in your name, your prices for clients, your demo settings, and your balance and top-up settings.
- The identifier of the Stripe account you connect so that your clients can pay you. We never hold that account's secret key.
- Your usage: calls answered, minutes used, charges taken, top-ups made, and the payments your clients make through the platform.
- Support requests you raise, and the record of each time you or we use "view as" to see a client's account as the client sees it.
- Emails and text messages we send you, and whether they were delivered.
From anyone who contacts us
- Your name, email address, and the content of your message.
4. Why we use it, and the lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Keeping the website and the platform secure | Visitor data, account data | Legitimate interests: our interest in protecting the site, the platform and the people who use them from attack and misuse |
| Running the demo and enforcing its caps | Demo data | Legitimate interests: our interest in showing prospective resellers how the agent works, and in stopping the demo being drained |
| Opening and running your reseller account, including sign-in, support and the dashboard | Reseller data | Performance of our contract with you |
| Taking payment and billing you | Billing data | Performance of our contract with you |
| Preventing fraud | Billing and account data | Legitimate interests: our interest in preventing fraudulent payments and accounts |
| Registering a text sender in your name where you provide business details | Business details | Performance of our contract with you |
| Sending you service messages: receipts, balance warnings, failed-payment notices, alerts about your clients' lines, and changes to the terms | Contact details, usage | Performance of our contract with you |
| Sending you marketing email about Novaris | Email address | Consent, which you can withdraw at any time |
| Understanding use of the site and sign-up, including masked session replay | Visitor data, sign-up progress | Consent for UK and EU visitors. For US visitors, legitimate interests in improving the site, subject to the opt-out in section 7 and applicable law |
| Measuring advertising, on the marketing site and in the app's demo, sign-up and payment steps | Visitor data | Consent, for visitors in the United Kingdom and the European Union. For US visitors, legitimate interests in measuring whether our advertising works, subject to opt-out and applicable law. See section 7 |
| Keeping accounting and tax records | Billing and account records | Legal obligation |
| Establishing, exercising or defending legal claims | Account, billing and audit records | Legitimate interests: our interest in protecting our legal position in a dispute |
5. Who we share it with
We share personal data with service providers that act on our instructions, in these categories:
- hosting and database providers;
- a sign-in provider;
- a payment provider, which also operates the connection to your own Stripe account;
- an email delivery provider, and a text messaging provider, for the messages we send you;
- telephony and speech providers, for the demo;
- an analytics provider, for page views, clicks, sign-up progress and masked session replay;
- an error-tracking provider, for technical errors; and
- a provider that reads a business's public website during setup, where a website address is given.
We also share visitor data with Meta, a social advertising network, for the advertising measurement in section 7.
We also share data where the law requires it, with professional advisers, and with a buyer or successor of our business.
Each reseller publishes, on its own site, the list of providers that process its clients' and callers' data.
6. International transfers
Most of our service providers, and the advertising network in section 7, are in the United States. Personal data described in this notice will be transferred outside the United Kingdom.
Where a recipient is certified under the EU-US Data Privacy Framework and its UK Extension, we rely on that certification. Where a recipient is not certified, we transfer data under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us at privacy@novariscall.com which safeguard applies to a category of provider.
7. Cookies and analytics
7.1 app.novariscall.com uses the cookies needed to sign you in and keep you signed in, and the first-party analytics described in 7.3 to measure which steps of sign-up are reached. Its demo, sign-up and payment steps also use the advertising measurement described in 7.4. Sign-in cookies are not shared with any other address.
7.2 Strictly necessary cookies. Cookies needed for the site to work, such as the one that remembers your cookie choices, are set without asking.
7.3 Analytics and session replay. Analytics measures page views, clicks and sign-up progress to help us improve the site. It also includes masked session replay, which lets us review how a visitor uses permitted public pages. Replay is restricted to approved public pages; it does not run on signed-in, account, sign-up or payment pages. Text and inputs are masked, and forms and payment frames are blocked from replay.
For visitors in the United Kingdom and European Union, Analytics, including session replay, is off until you affirmatively allow it. For visitors in the United States, it starts on and you can turn it off. If we cannot determine a region, it starts off. Other regions follow the choices shown in Cookie settings.
7.4 Marketing. www.novariscall.com, and the demo, sign-up and payment steps of app.novariscall.com, use advertising pixels and other storage technologies, including Meta, and our servers send Meta information about these visits, so we can see whether our advertising works. Meta may use this information to measure and target ads. This is separate from session replay. Marketing is off until UK and EU visitors affirmatively allow it. For US visitors it starts on, and you can opt out, including from ad targeting. Marketing starts off in other or unknown regions. Global Privacy Control and browser Do Not Track signals turn Marketing off, including after an earlier opt-in.
7.5 Your choices. The banner names Analytics, including masked session replay, and Marketing. You can accept all, reject all optional categories, or choose each category in Cookie settings. You can withdraw or change your choices at any time using Cookie settings at the foot of the page. The Do Not Sell or Share My Personal Information link turns Marketing off while keeping your separate Analytics choice. Necessary cookies remain on. Turning Analytics off stops further replay; turning Marketing off stops further advertising measurement in the browser and new server-side measurement based on that choice.
8. How long we keep it
We keep personal data for as long as reasonably necessary for the purpose we collected it. A fixed period applies only where the platform enforces one or the law sets one.
| Data | How long |
|---|---|
| What is said in the demo, as a transcript, and any recording of it | Deleted 90 days after the demo call ends. The record that a call happened, and its length, is kept for as long as reasonably necessary to enforce the demo's caps and to account for its cost. |
| Website logs | As long as reasonably necessary to keep the site secure and to investigate an incident. |
| Reseller account, brand, settings and usage | While your account is open, and afterwards for as long as reasonably necessary to resolve disputes, enforce the Reseller Agreement and meet our legal obligations. |
| A closed account | Handled by the offboarding process: a 14-day grace period in which the request can be withdrawn, after which personal details are removed from the records we keep and the rest of the account is hidden from every screen. |
| An unfinished sign-up | As long as reasonably necessary to let you finish signing up, and to prevent misuse of the sign-up. |
| Records of money: top-ups, charges, invoices, payments and payment-provider events | As long as tax and accounting law requires, which in the United Kingdom is six years after the end of the accounting period they relate to. |
| Your acceptance of the Reseller Agreement | As long as reasonably necessary to enforce the Reseller Agreement and to resolve any dispute under it. |
| Support requests and audit records of "view as" use | As long as reasonably necessary to resolve the request, investigate misuse and resolve disputes. |
| Emails and text messages we sent you | As long as reasonably necessary to show what we told you and when. |
| Advertising measurement data and cookies | Up to 13 months. |
| Backups | As long as reasonably necessary to restore the platform after a failure. Data deleted from the live platform is removed from backups when the backup expires. |
9. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct it;
- ask us to delete it, where we have no continuing reason to keep it;
- ask us to restrict how we use it;
- object to our use of it, where we rely on legitimate interests;
- receive the data you gave us in a portable form; and
- withdraw consent at any time, where we rely on consent.
Write to privacy@novariscall.com. We will respond within one month, or tell you if we need longer. We may ask you to confirm your identity.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
If you are in the United States. You can ask to access, correct or delete your personal data by writing to privacy@novariscall.com. We will confirm receipt and respond within the time the law allows. Under some US state laws, the advertising measurement in section 7 may count as a sale or sharing of personal information. For visitors in the United States it is on by default, subject to browser opt-out signals. You can opt out in the notice shown on your first visit, or at any time from the cookie settings link at the foot of every page, as section 7 describes. If you are in California, you can also opt out with the "Do Not Sell or Share My Personal Information" link at the foot of every page. We do not treat you differently for exercising these rights.
10. Providing your data
To open a reseller account you must complete the sign-up form. Without it we cannot open the account. Business details for a text sender registration are optional; without them, account alerts come by email and from a shared platform number.
11. Automated decisions
If a reseller's payment is overdue, the account may be paused automatically, as the Reseller Agreement sets out. We usually wait 7 days and send reminders first, but this is a courtesy, not a commitment. The account resumes when the payment is made. No profiling or scoring takes place. A reseller can ask us to review the pause by writing to support@novariscall.com, and a person will look at it.
12. Children
Our websites and the platform are for businesses. They are not directed at children, and we do not knowingly collect children's data.
13. Security
We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit and at rest, encrypted storage of credentials, access limited to those who need it, and daily backups. No system is perfectly secure, and we cannot promise that unauthorized access will never occur.
14. Changes to this notice
We may update this notice. We will give at least 30 days' notice of a material change by posting the new version at this address with its effective date and, for resellers, by email. A change required by law or a regulator may take effect sooner, with notice as soon as reasonably possible. A correction or clarification that does not reduce your rights takes effect on publication.